CVE-2026-12865: CWE-79 Cross-Site Scripting (XSS) in Photo Gallery by 10Web

The Photo Gallery by 10Web WordPress plugin versions prior to 1.8.44 fail to escape two request parameters before reflecting them into input-attribute values on admin pages, specifically on the Shortcode page and the Galleries/Albums list page. This allows an unauthenticated attacker to craft a link that, when visited by a logged-in administrator or contributor, executes arbitrary JavaScript via an auto-firing onfocus event handler. The Galleries/Albums vulnerability manifests only when the site contains more than 20 galleries or albums, which is typical for populated installations. This vulnerability is tracked as CVE-2026-12865 and is classified under CWE-79 (Cross-Site Scripting).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of an authenticated administrator or contributor session. This can lead to session hijacking, privilege escalation, or other malicious actions within the WordPress admin interface. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS vector (C:L/I:L/A:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected admin pages to trusted users only and avoid clicking on suspicious links. Monitor official 10Web communications for updates and apply patches promptly once released.